Apple Lossless Audio Codec is now open source (Apache license) - <AUTHOR> http://alac.macosforge.org/ <comment><USER3> Is there an advantage to this for someone who owns no Apple products and has no iTunes account?

EDIT: Looking at [http://wiki.hydrogenaudio.org/index.php?title=Lossless_compa...](http://wiki.hydrogenaudio.org/index.php?title=Lossless_comparison#Apple_Lossless_Audio_Codec_.28ALAC.29) it looks like the only clear advantage ALAC has is iTunes/iDevice support. FLAC has faster encoding/decoding speeds, and it's unknown if ALAC has error handling (which FLAC has). FLAC also supports RIFF chunks, has pipe support and is ReplayGain compatible, and has some support for embedded CUE sheets.

<comment><USER4> And yet the most major popular MP3 player on the market can't play FLAC, which will probably mean it will remain as obscure as it is now (i.e., mostly used among audiophiles).

<comment><USER5> It's not that obscure. You can _buy_ Metallica and Beatles tracks in FLAC.

<comment><USER6> Most, if not all of the tracks on bandcamp.com are sold with a FLAC option.

<comment><USER7> FLAC is the defacto lossless standard everywhere but iTunes. Boomkat, Bleep etc sell FLAC files. It also works in music software like Traktor, Ableton Live and Renoise.

FLAC is honestly one of the happier OSS success stories.

</comment></comment></comment></comment></comment><comment><USER8> For those unfamiliar with the site, MacOSForge is an official Apple site which hosts repositories for code included in OS X (see <http://www.opensource.apple.com/> and the sidebar)

The announcement with timestamp for today is on the homepage: <http://www.macosforge.org/>

<comment><USER9> I don't know why Apple has gotten THAT much flak for allegedly being totally closed and locking you down worse than Microsoft did back in the dark ages etc. Yes, they have certain core products which are their own and they don't open them up and the locking down of their iPhones, well, it could be a blessing and a curse. I will only say that from the perspective of a regular customer, the quality control done on apps is probably not such a bad thing but yes, for app developers it probably just sucks. And the music you buy online on iTunes now comes pretty much without any DRM in high quality AAC.

But they are not ONLY "evil" because at the same time, Apple did contribute to open standards and there is a lot of Open Source available. It is, however, still a business so for me, it seems they are playing it smart and do "open" where it also benefits them and their customers and do "closed/locked down" where it is critical for their own success or in accordance with their product philosophy or the reality distortion field.

<comment><USER10> The problem is that Apple's _business model_ is based upon selling artificially scarce content (music, applications, etc) over closed and restrictive platforms. A couple of open products isn't going to change their fundamental business model.

The argument that "Apple is just a business" doesn't hold weight for me either because there are clearly superior business models out their like Google's which is based upon free software (linux) and intelligent cloud services (search).

<comment><USER11> No, look at the quarter results of Apple. Their revenue is selling hardware stuff. Digital content is relatively a small amount. I also find "artificially scarce" a very biased description. The App Store has an unbelievable positive impact on the developer ecosystem. And if books/gamecartridges/printed newspaper are replaced by digital stuff we shouldn't deride payment for that. Look at ebooks or Amazon kindle. These are good things. The scarce thing is really your favorite band making a kickass song, investigative journalism instead of astroturfing and GRRM writing the next ASOIAF novel in less than five years.

About Googles "superior business model": Ultimately it is just advertising. The product which is sold is you. I don't want to sound polemic, I have tons of respect for Google. But this is a strong realization most never make. Because of that I avoid to being to dependent on their services (maybe I will move my email from gmail to icloud).

EDIT:

Oh, never mind. I just read your other reply to kawahe. You clearly are enlightened and are not bound by the chains of tyranny. I am out of this discussion.

<comment><USER10> _The App Store has an unbelievable positive impact on the developer ecosystem._

Paul Graham (the creator of this site) commented on the App Store himself, and his words were not entirely of ignorant praise like yours are:

<http://www.paulgraham.com/apple.html>

 _The scarce thing is really your favorite band making a kickass song, investigative journalism instead of astroturfing and GRRM writing the next ASOIAF novel in less than five years._

Although this is besides the point, it is pretty easy to envision a moneyless post-scarcity society where such songs, novels, reports, and other forms of content are delivered to everyone free of charge:

<http://adciv.org/>

<comment><USER9> > _Paul Graham (the creator of this site) commented on the App Store himself, > and his words were not entirely of ignorant praise like yours are_

And you will find just as many people who love the app store oh and 18,000,000,000+ downloads and counting should nicely prove those 2 year old prophecies wrong.

<comment><USER10> The fact is Apple's reputation has been permanently tarnished in the face of developers, including PG. Even today, Apple uses very restrictive license agreements in the appstore. Here is a full explanation of their licensing restrictions from 2010, feel free to provide more up to date information:

[https://www.eff.org/deeplinks/2010/03/iphone-developer- progr...](https://www.eff.org/deeplinks/2010/03/iphone-developer-program- license-agreement-all)

<comment><USER12> Resorting to _ad verecundiam_ doesn't prove or disprove your point either way. It's just an opinion.

<comment><USER10> Before you blame me for argument for authority, notice that rolfd's post is already ridiculously exaggerated because he said "it has an _unbelievable_ positive impact."

<comment><USER12> _Tu quoque_ fallacies are just as bad. Anyone using emotive words or unnecessary superlatives undermine the point they are attempting to make.

<comment><USER10> Forget it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> This is fantastic. Apple uses AAC partly because of the patent royalty (<http://mp3licensing.com/>) which they have to pay on every iPad/pod/etc sold, as well as because it is just a better format.

MP3 is a total racket held by Thompson Technicolor, on top of being a pretty crap format.

Hopefully this is a portends Apple offering lossless through ITMS on top of the 1080p rights they are hunting down right now.

<comment><USER14> MP3 was great for its time. It's not a crap format, there are merely better formats available today. They weren't when MP3 came to the market. (Specifically AAC was developed as a successor to MP3.)

I'm also not sure whether this tells you anything. Apple started selling AAC encoded music at a time when no† music player could play it. Many mistakenly thought that AAC was some sort of proprietary Apple codec and it might as well have been.

Today more people than ever have an iOS device or an iPod. There is no need at all for Apple to play nice and make sure that others can also use the ALAC. Why should they?

Also: What's the incentive for offering lossless music? No one† can tell the difference. Do you really think Apple will start catering to audiophiles? Because of the switch to flash memory space is limited, Apple's current devices are not a good match for lossless music.

—

† Don't be pedantic.

<comment><USER13> Lossless music - there is an audience for it, and it creates the ability to stratify prices, which the labels/rights-holders/distributors like. See the vinyl boom, hdtracks.com, <http://www.becausesoundmatters.com/>, etc.

So will Apple cater to audiophiles? No. Will they cater to margins? For damned sure they will if it serves them and those they entice to sign over content. Why would they switch to 1080P otherwise?

Also: given device sizes it would be nice to have raw uncompressed/lossless and I could downsample at will to suit specific devices/systems.

<comment><USER15> I only buy lossless music. I usually end up buying WAV/AIFF/FLAC direct from the artist, from their record label, or from Beatport. Once in a while, if I can't find something, I'll buy it on CD. Earlier today, I actually bought vinyl because I couldn't find a lossless digital version of this track anywhere: <http://www.youtube.com/watch?v=AwsUfEvmKwI>

Lossy formats are useless to me since I can't remix them without it sounding like crap. I also feel I'm getting ripped-off when they charge near CD price for lossy tracks.

Also, 20 years from now I'm going to want to convert my music to whatever fancy lossy codec has supplanted MP3 and AAC. By archiving in an open lossless format like FLAC (or now ALAC), I can do this without introducing artifacts.

<comment><USER16> Do you really think you could hear the difference between 256kbps AAC and Lossless? Even if your hearing is way above average, most audio players and earphones aren't that good.

(Also, given the less-than-subtle music you linked to, I doubt that it really matters.)

<comment><USER15> No, I can't; and I wasn't claiming that I can. However, as I stated, if I use an MP3 or AAC in a remix, then compress my remix using a lossy codec like AAC or MP3, the result will sound like crap. It's similar to working with JPEGs in Photoshop (rather than RAW), then trying to re-compress to JPEG: you usually get artifacts.

I've been playing classic violin since the age of 3, and I'm _very_ sensitive to details. Just because you don't find a particular genre of music "subtle" doesn't it's not susceptible to the compression artifacts I'm talking about.

<comment><USER17> > _if I use an MP3 or AAC in a remix, then compress my remix using a lossy > codec like AAC or MP3, the result will sound like crap_

Or far more likely, it won't sound like crap.

> trying to re-compress to JPEG: you usually get artifacts.

This argument is akin to suggesting that a very very very minimally JPEG compressed screenshot of a website is inferior to plonking a film camera in front of your LCD and exposing a frame. After all, big analogue artefacts don't matter nearly as much.

The reality is, AAC at 256kbps is such a light touch that it could probably survive four or five rounds of offset re-encoding before the artefacts would compound meaningfully.

<comment><USER18> Again, you forget he's also remixing. That changes the whole game. You may be right if re-encoding was all he does, but it isn't.

You take the 256kbps high quality AAC, and you time stretch and repitch it by a few percent (to match it up with the track you're mixing it into) and probably fiddle the equalizer a bit, to "drop the bass" :)

If you do _that_ a few times, you're losing information, even on a lossless digital medium.

If you use even high quality audiocodecs in between, it _will_ sound like crap. And not the kind of super subtle near-impossible to hear difference between lossless and 256kbps AAC crap, but actual crap. I know this from experience myself as well. The sound becomes really flat, hard to describe, but you notice it when you're playing one right next to another track that hasn't been through such a process. It's like you want to turn it up louder but it's already loud enough. Hard to describe, but it's a real problem if you're playing these mixes on high quality speakers in a club--suddenly the sound is not as crisp anymore, and the crowd notices it too.

If you want to make the analogy with JPEG, imagine re-encoding at 95% quality, but with a few percent scaling and a few degrees rotation in between, before saving again as 95% quality JPEG.

You do that twice, with a quality high res digital photograph, and you're going to wind up with a photo that looks pretty much like the original ... until you make a high res print of it (or zoom in on the screen). Edges that were crisp at first have gone fuzzy, and at places you can spot the typical blocking and ringing JPEG artefacts.

You'd probably get away with it, most of the time, too. But not always, and if you're a digital graphics professional, this is your craft, and the mark of a good craftsman is that they put in the work for the little details that you don't really notice, until they're not there, and how you tell you're holding a piece of quality work.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> I've got all my CDs ripped in ALAC so that I can use the iTunes option to have the tracks automatically transcoded to smaller, lossy AAC when putting them on iDevices.

I welcome this open sourcing because it makes my 'archival' format slightly less oddball.

<comment><USER20> ffmpeg already can transcode from alac to flac, I rip with itunes and transcode to flac for my Sansa Clip.

</comment></comment><comment><USER21> Someone came up with a reverse engineered decoder 6+ years ago:

<http://craz.net/programs/itunes/alac.html>

Nice to have an encoder now too.

<comment><USER22> I worked on this with craz, taking directly "decompiled" code into a useful form. This was by far one of the most interesting things I've ever done -- if you want to get into reversing or increase your skills, do a codec! I built a stupid simple reference encoder in Python right after, but never managed to really get it right; wonder if I still have all the old code around.

</comment></comment><comment><USER15> I just tried building libalac.a on Linux using GCC 4.6.1 and it worked! There were quite a few warnings though.

To eliminate the warnings, edit /trunk/codec/makefile and add -Wno-multichar to CFLAGS.

</comment><comment><USER23> There's no mention of a patent grant. Does anybody know the state of ALAC with regards to patents?

<comment><USER24> I believe the apache 2.0 license [1] includes a grant.

         3. Grant of Patent License. Subject to the terms and
         conditions of this License, each Contributor hereby grants
         to You a perpetual, worldwide, non-exclusive, no-charge,
         royalty-free, irrevocable (except as stated in this section)
         patent license to make, have made, use, offer to sell, sell,
         import, and otherwise transfer the Work, where such license
         applies only to those patent claims licensable by such
         Contributor that are necessarily infringed by their
         Contribution(s) alone or by combination of their
         Contribution(s) with the Work to which such Contribution(s)
         was submitted. If You institute patent litigation against
         any entity (including a cross-claim or counterclaim in a
         lawsuit) alleging that the Work or a Contribution
         incorporated within the Work constitutes direct or
         contributory patent infringement, then any patent licenses
         granted to You under this License for that Work shall
         terminate as of the date such litigation is filed.

[1]: <http://www.apache.org/licenses/LICENSE-2.0>

<comment><USER25> So, the next question is: is the container format (MPEG-4 Part 14) patent encumbered?

<comment><USER26> There is no active patent pool for MPEG-4 systems.

</comment></comment></comment></comment><comment><USER27> What's the point of this over flac?

<comment><USER28> consumer products that actually support it?

<comment><USER29> FLAC has been supported by Rockbox <http://www.rockbox.org/> since 2005.. I remember using it in my iriver H300, iPods were supported as well

<comment><USER28> well yeah, decoders exist. Rockbox doesn't qualify as a "consumer product" in the sense I was using the term. IE, walk into my local electronics store and pick up a device and take it to the till. Good point (to the other poster) about the squeezebox though, quite correct.

</comment></comment></comment></comment><comment><USER30> I suspect that the big news here might be Airplay.

If you put this together with the rumours of an AppleTV there could be something very special here, especially if they are pre-emtively paving the way for open-source, 3rd party developers.

</comment><comment><USER31> Would be great if android implemented encoding to that format now. Its a pain to try to get the same audio formats from both Android and iOS devices because both platforms encode to completely different formats.

</comment><comment><USER32> does this mean that FLAC will soon be irrelevant ?

Today a lot of high-fidelity audio players support FLAC as the default lossless format. This kinda meant that that iPods and these players lived in different universes as far as lossless is concerned.

If the release of this codec means that h/w manufacturers are able to incorporate this codec into their silicon (I'm not sure if the open source license extends to hardware), then effectively there is no _real_ reason to use or support FLAC anymore (minor differences in quality nonwithstanding).

Anybody know which codec is more power efficient ?

<comment><USER33> Irrelevant is a strong word, and I very much doubt it. The only reason for making this open source was for devices to be able to support this more. However FLAC has been open source for quite a while - consequently most device makers willing to make the effort to support loss-less audio codec already did so with FLAC. Support for ALAC will mostly come for these devices. Conversely, I see no reason for any device to support ALAC and not FLAC.

According to Wikipedia, FLAC is more efficient in encoding/decoding speeds - with same compression ratio. This translates to it being more power efficient.

Lastly this news will matter to only a few audiophiles who are also Apple geeks.

Making something open source is a welcome gesture, but I hope Apple will do this for other items which will have better reaching consequences.

<comment><USER32> _Conversely, I see no reason for any device to support ALAC and not FLAC._

Isnt this implemented in silicon (or atleast implemented as some DSP-specific library) ? AFAIK that costs money.

Today, if you wanted a lossless player, that player _had_ to have FLAC - <USER2> was taken from a commercial vendor like Tensilica [1]. But now that ALAC is an alternative, why would I even try to spend more money and also add FLAC ?

Plus, it is reasonably trivial to convert all FLAC to ALAC [2]

[1] [http://www.tensilica.com/products/audio/audio- codecs/flac.ht...](http://www.tensilica.com/products/audio/audio- codecs/flac.htm) or <http://www.tensilica.com/products/audio/audio-codecs.htm> (no ALAC)

[2] <http://www.dbpoweramp.com/dmc.htm>

</comment></comment></comment><comment><USER34> This is amazing. Since running Mugasha for the past few years, encoding in AAC has been a huge hassle. Lib faac has terrible encoding quality compared to good ones like Nero and Apple.

</comment><comment><USER35> What I don't get is why don't places like iTunes and Amazon offer Lossless options for downloading? I mean, here they are bragging about 720p, 1080p, high definition video which is gigantic in size, approaching or exceeding gigabytes for a typical 2 hour movie. Yet, we can't spare the extra space or bandwidth for a higher quality audio file which is still a fraction of the size? I don't get it.

<comment><USER19> That video isn't lossless either. The _mostly-indistinguishable-from-lossless_ point has already been reached for downloadable audio, whereas video is still creeping up on it.

<comment><USER35> Yes,I know this, but the size of the video files are much greater than the music files. I hear people complaining about the sizes of lossless music files, but not about 1080p video files. In fact, I have read comments from people complaining about only having 720p available from iTunes because of their 1080p televisions. However, these files are measured better in terms of gigabytes instead of megabytes. In other words, lossless music files shouldn't be problem, especially so with the cost of storage and bandwidth available. They are not that large when you compare them to even compressed video files (that are 720p or even 1080p).

</comment></comment></comment><comment><USER36> I hope Google adds (hardware) support for this to Android - it would add another option for patent un-encumbered audio formats, outside of Vorbis.

<comment><USER37> FLAC has been around longer and is also part of the Xiph.org project along with Vorbis. If Google wanted to add a lossless codec, they certainly could have before now.

(Disclaimer: I am associated with Xiph.org.)

<comment><USER38> It looks like it's been done, as of Honeycomb for tablets and Ice Cream Sandwich for phones: <https://code.google.com/p/android/issues/detail?id=1461>

<comment><USER39> It may or may not be done. Samsung products tend to support codecs that vanilla Android does not support. As of 2.3.7 (latest published source), it is not in the source tree.

<comment><USER38> The link I posted is for a Google issue that was marked as Released. Hopefully we'll see it in there when the ICS source code is released.

</comment></comment></comment></comment></comment><comment><USER40> A successor to MP3.

We know there are better formats than MP3 today but getting mass adoption is difficult. Open source ALAC will give birth to new 3rd party supporting players, not to mention apple products already supports it & we have higher chances of mass adoption.

<comment><USER41> No, AAC was a successor to MP3, about a decade ago. This is a lossless format, so not really suitable for the same roles.

</comment></comment><comment><USER15> FINALLY!!! But what does this mean for the future of FLAC?

<comment><USER42> Nothing much? People with lossless collections in FLAC are likely to continue building them in FLAC. And if they switch over to AAC, then there is no loss. With free lossless audio codecs, everyone wins.

<comment><USER16> ALAC ≠ AAC

ALAC : AAC : : FLAC : MP3

<comment><USER43> Your point that ALAC != AAC is true and all but a better comparison would probably be

ALAC : AAC :: FLAC : Ogg Vorbis

<comment><USER16> Agreed.

</comment></comment></comment></comment></comment><comment><USER44> I see a trac browser for SVN, but i see no SVN link. Any idea what that may be or what an easy way to determine it is?

</comment><comment><USER15> Anyone know the URL for the repo? It looks like they're using Subversion, but I don't see any svn:// links anywhere.

<comment><USER45> <http://svn.macosforge.org/repository/alac/trunk>

<comment><USER44> Sweet.

And not so sweet: I get a nice failure to build the "convert-utility" on link.

It seems that there is some work to be done on this. I expect the best thing would be for the knowledge/info contained within the source to be merged into exsisting software.

</comment></comment></comment><comment><USER46> Awesome! Now embedded devices like my car will be able to play more than just MP3's!

</comment><comment><USER47> Open source, sure. But patent free?

Comment here indicates no:

<http://news.ycombinator.com/item?id=3166268>

If AAC costs $1/device to implement, who exactly cares that the code is "opened"?

<comment><USER48> Two mistakes here:

(1) Apple Lossless, not AAC. Apple is not open-sourcing their AAC decoder, which is part of QuickTime.

(2) The Apache license grants a royalty-free patent license.</comment></comment>


Hosting a simple static site on IPFS - <AUTHOR> https://gateway.ipfs.io/ipns/QmWGb7PZmLb1TwsMkE1b8jVK4LGceMYMsWaSmviSucWPGG/2015/09/15/hosting-a-website-on-ipfs/ <comment><USER2> Morphis, ipfs and Freenet all work similarly here - allowing hosting websites in a distributed datastore. It'll be interesting to track the different usages of the systems.

I started off mirroring my blog on Freenet and and now I'm experimenting with storing it there first and using a reverse proxy to make it available on clearnet [1]. This approach would work on IPFS and Morphis too. If the clearnet site gets taken down it's always available on the distributed store and it's simple to spin up a proxy somewhere else to provide clearnet access.

For systems where unpopular data goes away over time the access via the clearnet proxy provides more access to it to make that less likely since clearnet is full of crawlers, bots, search engines etc constantly hitting it.

[1] [http://bluishcoder.co.nz/2015/09/14/using-freenet-for- static...](http://bluishcoder.co.nz/2015/09/14/using-freenet-for-static- websites.html)

</comment><comment><USER3> This is the first time I'm seeing IPFS. So when the IPFS servers are running, they register themselves with some central node to let everyone know they exist/are online? This is how they get away without a static IP address? Am I thinking about this correctly?

<comment><USER4> No, IPFS uses a distributed hash table to find content and nodes on the network. The only centralised servers are the gateways between the regular Internet and IPFS, due to necessity. However it is possible to run your own gateway, and many do.

<comment><USER3> How are new nodes discovered or registered?

<comment><USER5> For now, there is a default bootstrap list:

[https://github.com/ipfs/go- ipfs/blob/7fbfecf6fab5920317de2e9...](https://github.com/ipfs/go- ipfs/blob/7fbfecf6fab5920317de2e999e96d3fd145bcecf/repo/config/bootstrap_peers.go#L16)

When new nodes enter the network, they connect to a subset of this list and use this as a starting point for discovery.

After that, queries/operations on the DHT will result in the discovery of other nodes.

<comment><USER6> The bootstrap list isn't hard coded, it's just a default. Here's how to work with the bootstrap list: [https://ipfs.io/ipfs/QmTkzDwWqPbnAh5YiV5VwcTLnGdwSNsNTn2aDxd...](https://ipfs.io/ipfs/QmTkzDwWqPbnAh5YiV5VwcTLnGdwSNsNTn2aDxdXBFca7D/example#/ipfs/QmThrNbvLj7afQZhxH72m5Nn1qiVn3eMKWFYV49Zp2mv9B/bootstrap/readme.md) (from ipfs.io/docs/examples)

</comment></comment></comment></comment></comment><comment><USER7> That's a horrific url though, any way to 'humanise' that?

<comment><USER8> Yes. (IPFS author here)

1\. Add a TXT record to DNS <domain> with:

       dnslink="/ipns/QmWGb7PZmLb1TwsMkE1b8jVK4LGceMYMsWaSmviSucWPGG"

2\. should be able to use [https://ipfs.io/ipns/<domain>](https://ipfs.io/ipns/<domain>)

See it in action here: [https://ipfs.io/ipns/ipfs.io](https://ipfs.io/ipns/ipfs.io)

WARNING: IPNS is still under dev. it's not robust yet, convergence may not be perfect.

<comment><USER4> Also - if I remember correctly - if you visit ipfs.io with the Host header set to foo.com, it will return /ipns/foo.com.

<comment><USER6> Yes exactly, the IPFS daemon running there looks at the Host: header and uses it to build an `/ipns/<the-header>` path which it will resolve and respond accordingly.

</comment></comment></comment></comment><comment><USER9> Isn't IPNS a centralised component? If not, how does it work?

<comment><USER10> If I remember correctly, signed updates in the DHT that also is used for locating nodes with specific content. Check out the paper on ipfs.io, it explains all the components.

<comment><USER9> From section 3.7.1 of the paper

>"Because this is not a content-addressed object, pub- lishing it relies on the only mutable state distribution system in IPFS, the Routing system. The process is (1) publish the object as a regular immutable IPFS object, (2) publish its hash on the Routing system as a metadata value"

How is the ordering done? In a quickly changing content, a blockchain would be required for ordering.

<comment><USER11> Well, I would assume that you could trust the person signing things with a private key about whether it was what they wanted to be treated as the most recent thing to be signed with the private key?

But, I might be misunderstanding some things about how the updates are sent.

I thought one just sent a message signed with the key with a newer ID and sent that to whoever was keeping track, and they would verify it was signed, and had a newer id and would share it further.

Is this not how it works?

I mean I guess malicious or lazy nodes could not toward things, but that would just make things not get updated, usually couldn't cause things to revert, and couldn't make up stuff, so...

That's how it works, right?

<comment><USER8> (IPFS author here)

You're hitting on some really hard questions :)

the gist is that you use a "record system" that has some transport guarantees, for example relying on a dht has certain kind of properties, as opposed to relying on pub/sub over trusted nodes. IPFS has this part as pluggable, though we're focusing on a large public DHT first. DHTs are pretty robust today, though yes have weaknesses we're working on.

now, the key is that, on top of that, you build assurances around cryptographic freshness (i.e. "trust this record for a certain amount of time"). of course, "certain amount of time" varies with your notion of time (e.g. NTP, vs blockchain times, etc), so the user gets to set that.

if you're interested in how the "record system" works and will evolve, take a look at [https://github.com/ipfs/specs/tree/master/records](https://github.com/ipfs/specs/tree/master/records) \-- though admittedly this is not complete or exhaustive, as we have A TON to do and are focusing on pushing out reliable code.

</comment></comment></comment></comment></comment><comment><USER12> >Whenever you update your site, just do step 4 again, and IPNS will make sure anyone asking for your peedID gets the hash of your latest site.

s/peedID/peerID :)

<comment><AUTHOR> Thanks

</comment></comment><comment><USER13> If you use this tutorial to publish anything other than the example index.html, then attempt to view it through the proxy, it will fail with "Path Resolve error: context deadline exceeded." You need to run "ipfs daemon" on your local machine in order for it to be visible to the world.

</comment><comment><USER14> I have a small question for people who know better than me about IPFS. Does IPFS includes some equivalent of the USK (Updatable keys) concept in Freenet ? How things can be updated ?

<comment><USER15> IPFS also has IPNS. IPNS allows you to use your peer id (that you get by running the daemon) as a name. So if your peed id is "A", you can point "A" to hash "123" and give "A" to the people you want to share the content with. If you now add a new thing and get the hash "456", you can update "A" to now point to that hash instead. That way, you can update the content seamlessly, without breaking things for other people.

</comment></comment><comment><USER16> php -S localhost:8000</comment>


Ask HN: What has the greatest potential to disrupt Amazon's e-commerce business? - <AUTHOR> <comment><USER2> Shopify bought a few warehouses from the folks who built Amazon's robots & warehouse systems:

[https://business.financialpost.com/news/retail- marketing/sho...](https://business.financialpost.com/news/retail- marketing/shopify-launches-network-of-warehouses-and-shipping-in-u-s-to- handle-orders-for-independent-merchants)

</comment><comment><USER3> The AWS folks break free of their division and start naming services on the Amazon retail side of the house.</comment>


The shittiest project I ever worked on - <AUTHOR> http://blog.plover.com/tech/prudential.html <comment><USER2> Although it's a fun read, it's a classic example of diving into coding without giving a project it's due diligence. There's nothing that's derailed my projects more consistently when I started out as not understanding the user's needs. They'll never tell you what they want, only what they don't want after you deliver something.

I think that's the key difference to an experienced dev/BA. One who can actually sit with the stakeholders and build the system on paper and go through each of the problems as the diagrams connect. What you end up with is the stated requirements (tip) and the unstated assumptions (iceberg).

These types of projects are easily spotted as they're often called "quick" or "easy", which in layman's means no one's really thought about it yet.

<comment><USER3> Kind of agree with you _and_ OP, so let me add to the discussion with the caveat that YMMV etc. Some of these points may overlap with comments by fellow HNers in these threads.

In any organization as a prospective customer, there are three forces at work that matter to a consultant: users, decision makers and finance folks. Ideally, the decision makers appoint a dedicated person (or team) who mediates users and finance guys to create a coherent road map for the system to be built. What tends to happen in practice is a combination of chance, human errors and conflicts in priorities.

To survive, we must understand ourselves as consultants, the terrain and the opposing forces (anything that prevents money getting deposited in the bank).

Consulting is a business => the individual consultant must shoulder quite a lot on himself:

* Advertising himself

* Finding work

* Meeting prospective customers

* Writing proposals

* Closing the deal

* Writing a contract

* Defining the scope of work

* Nailing what is to be done and what is to be avoided

* Constructing components of software

* (In worst cases) baby-sitting customer's devs / ops

* Testing his modules

* Getting money in his account

So, when we talk with customers, there is inherent pressure in closing the deal versus precisely defining everything. Icing on the cake: back of the mind, you might worry about milkman's bills and the birthday gifts to be brought for your kid's friends. Always have a good runway: six months seems optimum. Technically, even three months should suffice, but it is insufficient for the edge case when these three things hold true simultaneously:

* You've to walk away from a customer in the middle of a project, _and_

* Dry sales pipeline, _and_

* Unexpected crisis at the personal front: very close friend in need of money for surgery etc.

God be with you.

Now, back to the main track. The key is to first understand the priorities of stakeholders. The contradictions are easier to grasp once we put ourselves in the individual's shoes:

* [Convenience] The users want everything including the kitchen sink,

* [Accountability for the risk] They want it yesterday but won't commit to it on paper since you're in early sales stage,

* [Cost] The finance folks want stability and the most economical price,

* [Availability] The decision maker prefers to spend the least of her time to be spent on this activity, except when it's her pet project.

These roles may be played by different people or the same person.

Again, we don't have to agree, but acknowledge that things are meant to be imperfect. Most people are actually decent and rational. Now, somehow, the consultant must figure out a good path. To begin, he should have a good handle on:

* The industry in which the customer operates, e.g. BFSI, Energy, online marketplaces, food, fashion etc.

* The nature of the market: oligopoly, crowded, emerging et al.

* The level of Govt. regulation: HIPAA? PCI?

* The customer's position: among top tier, mid-size, small firms.

* Customer's customers: helps to track the wind.

* Standard pain areas in the market.

* How customer's competition and partners survive the pain, specifically the differences among the customer's approach and the competitor's ones.

* The financial health of the customer: if possible, try to talk with their existing suppliers in other arenas (e.g. the guy who supplies printer cartridges, the cleaning lady etc.).

Based on that, assuming we've landed a hot lead, say that we want to convert it to money. There will be a lot of conversations over the phone, e-mail, chats, face to face; what is to be left out of those conversations is really context sensitive. The important parts are:

* What problem we're going to solve for all stakeholders?

* How we're going to solve it?

* Communicating our approach and progress on a timely basis.

* Improving Vulcan skills: like money, expression of anger is a great servant but a terrible master.

I leave out the details on the development process, since it depends on the individual.

Here are a few things which worked for me marvellously in certain contexts and doomed in others:

* Setting expectations by explaining the cone of uncertainty in the estimation process. Always be prepared for some customers, who deliberately mislead you that they don't understand the mumbo-jumbo, projecting ignorance as a shield so that they can ruin you on payments. Mostly you should refuse such customers, unless you're in an extreme crisis on multiple fronts.

* Writing use cases for the modules / systems I was supposed to work. Most customers say that they don't want any time spent on "documentation," to which I reply that writing a document is not "typing" but "nailing the thoughts to deliver higher quality work."

* Creating mock ups using sketching tools (even Excel/LibreOffice can be good enough, if one is pressed too much for time) in the absence of UX designers on the team.

* Writing test cases before writing my code. Helps to ease the integration.

* Optimizing lazily: progressively refining the artefact (document / mock up / test / code).

* Knowing the expected value of each task: (amount of money * satisfaction * improvement in reputation) / (e-mail tennis * stakeholder's understanding of requirements * payment latency * time spent)

Finally, reducing it to just one sentence: be nice, believe in yourself and humanity, be multi-dimensional and please heed Guy Kawasaki's advice about reading voraciously and omnivorously.

Edit: formatting.

<comment><USER4> Awesome list - deserves a nice little blog post of its own that I can bookmark.

<comment><USER3> Thanks for the kind words.

</comment></comment></comment></comment><comment><USER5> For those who don't know about the author of this post. His name is Mark Jason Dominus, the author of one the most awesome programming book that one can ever read.

Higher Order Perl, is available for free download. If you read it you will see some amazing insights into programming techniques most people would have never heard of encountered in MegaCorp jobs. You will also grow a great appreciation for Perl in general and understand how it can be an amazing language of choice for a wide variety of problems.

<comment><USER6> I know it's probably totally unnecessary but still, here's a link to the free download page of the book [1].

Together with Modern Perl (also free for download [2]) this book completely changed my view of Perl. It helped me see through the misconceptions built (most of the times unintentionally) around this language and made me even switch from Python to Perl.

If you're interested, spend a few minutes browsing through one of these books. I think you'll like what you see.

[1] [http://hop.perl.plover.com/book/#PDF](http://hop.perl.plover.com/book/#PDF)

[2] [http://onyxneon.com/books/modern_perl/](http://onyxneon.com/books/modern_perl/)

</comment></comment><comment><USER7> >Prudential didn't need an affiliate locator application. They needed a static HTML page that told people to call the number.

They needed a competitor.

</comment><comment><USER8> > In 1995 I quit my regular job as senior web engineer

You had the job title "senior web engineer" when the web was 4 years old. That's pretty cool.

<comment><USER9> Sorry if it reduces self-esteem, but we (software developers) are not engineers.

I've been brainwashed for many years by my brother, who is a Phd civil engineer, that professions that hijack the term engineer are kidding themselves.

I know it sounds cool, and my current title is 'Senior Software Engineer', but it is all a scam.

<comment><USER10> I'm not convinced. Care to make a case?

<comment><USER11> The degree of responsibility is vastly different. Engineers are licensed, and can (and often are) sued for professional negligence. Failing to do your job adequately means you'll be stripped of your license and prevented from practicing engineering.

<comment><USER12> No, only certain fields of engineering are licensed and regulated. Those include Structural, Chemical, Mechanical, etc.

Others are less rigorous, but can still are the practice of engineering. Software Development is one of those.

</comment></comment></comment></comment></comment><comment><USER13> I'm surprised nobody, not even the author, has said that the program was useful anyway. But instead of publishing it in the web, it should have been used by the toll-free number operators.

</comment><comment><USER14> I never cease to be amazed that the more things change, the more they stay the same. If you removed the dates from this story, you'd be hard pressed to fix when this happened.

(Except the static HTML idea is a bit of a give away, no web developer would ever dare suggest a static page in our brave new world of Web X.0)

<comment><USER15> Just say we will load data(phone number) using AJAX in JSON format and everyone will be happy.

Page is static. JSON is a static file with a phone number. And use jQuery to load the JSON file.

<comment><USER16> My sarcasm detector is showing erratic results from your post. AJAX was 3 years from being invented and John Resig was about 10 years old in 1995.

Perhaps a whooshing sound should be made though, if I didn't get the joke..?!

<comment><USER17> You missed "If you removed the dates from this story.." in the parent comment.

<comment><USER16> Ah, thanks!

</comment></comment></comment></comment></comment><comment><USER18> > _These days I would handle this easily; after the first or second iteration > I would explain the situation: I had based my estimate on certain > expectations of how much work would be required; I had not expected to clean > up dirty data in eight different formats; they had the choice of delivering > clean data in the same format as before, renegotiating the fee, or finding > someone else to do the project._

Great advice for dealing with issues we did not consider in our estimate.

Had he charged hourly instead of a fixed price, would this project have been less shitty?

Edit: Fixed grammar. Thanks b0z0. :)

<comment><USER19> An hourly rate has the effect of focusing the client's mind a bit.

<comment><USER20> I find that fixed bids they try to take me for a ride, time and materials they are afraid to spend time with me to figure out what they actually want.

I have yet to find a customer unwilling to try to doom their own project or a compensation strategy that reliably prevents it - its just tons of work and communication. Unfortunately I'm just an okay coder and most people seem like they actually want a code talk therapist.

</comment></comment></comment><comment><USER21> Sounds about right.

I worked at Prudential about 10 years ago, as a FTE. Our small division mainly ran on a bunch of custom Access reporting applications. It wasn't quite cutting it, because Access, so it was decided that we would build a portal on the company's intranet. The only problem was that we, as accidental web developers, were not allowed to run development web servers on our dev machines, because they were locked down by corporate. We had to use an extra PC that, by some miracle, had IIS, and develop against that remotely. Good times.

</comment><comment><USER22> The title reminds me of the shittiest software job/project I ever worked on- short and sweet: Got hired off craigslist. It was all php. Their main competitor was "the spreadsheet". Worked directly next to a cold caller that repeated the same phrase over and over again, fake laugh and all. They were all from the same church group and tried to convert me multiple times. Paid minimum wage.

In addition to being funny in retrospect, it was a good lesson to me to learn that no matter how shitty your current situation, you can always improve it.

<comment><USER23> oooh... looks like someone has a case of the mondays.

</comment></comment><comment><USER24> The punch line here is great, but even if the specs necessitated something more than a static page, then it'd still be a hard job.

If the most critical part of a data heavy project is speccing it out, I'd say the next most important part is the data munging process...and sadly, both of these things are the most overlooked.

</comment><comment><USER25> I'm sure this is the very tough first lesson any new consultant with limited experience would learn. The summary is that the specs are incredibly important, they should be expensive to produce and they should protect you and your client.

</comment><comment><USER26> tl;dr

<comment><USER27> Ha! I think the people who downvotted this didn't realize that "mjd" is Mark Jason Dominus aka the guy who wrote the blog post.

<comment><USER28> Even then, the post adds no value to the discussion, so it deserves downvotes anyway. Its a great blog post, and I upvoted it, but its a bad comment, and I downvoted it.

<comment><USER29> Sure it does. It says that mjd is on HN, and reading this article's comments at _least_ enough to post this, and that he has a sense of humor.

I'm sure if someone so desired, they could ask a specific question regarding the story either in reply to the root comment or as a root comment and expect it may be seen by the author, and possibly get a reply.

<comment><USER28> I think the quality of the other responses to the parent indicates exactly how likely that is. A whole subtree full of gray comments.

Maybe I'm just getting old.

</comment></comment></comment></comment></comment><comment><USER30> That's not bad at all, it's sounds more like business as usual. I think it's my regular workday. Btw. Did the customer require extensive documentation, escrow, you to fix their data when they can't get it done (like invalid post area codes linked to wrong addresses, fixing post number / city information based on post area code) etc or looking it up based on street adress or so. Been there, done that. Did you spend several weeks in meetings where they can't decide how their stuff works, and you'll just keep wondering if they'll ever decide what they actually want etc. Of course they're going to completely change that week later etc. They don't have a clue how things should technically work, or even what the actuall business process is. Because they have bought an integration, everything must just automatically work, right? We need to know what females in age range 20-25 have bought during last month. Err, but we don't record customer age or sex? Well, but our management team needs that information. It's sure alarm sign, that they want to know how much "this" project will cost, but nobody really knows what "this" is. Also it's needs to be completed by end of the month. I have declined so many projects, and clearly told customers why I'm not going to do anything for them at all. Unless they accept it as "agile" project, with unlimited budget. Then I'll promise them that I'll personally see that it gets done, but it's going to be expensive. - 15 years of ERP/POS/BI/CRM integration programming & consulting.

</comment><comment><USER31> I am working on quite a tedious project right now. It involves 10 years old, quite extensive, Visual Basic 6 programs. No source control was used. In our company it is practice to hire interns for 3-month periods to work on production software. A mix of programming styles can be found in this project. Some functions return 0 when they fail. Others return 1. Or -1. Or False. Or "False". I love it!

<comment><USER32> Count yourself lucky there was any error handling at all! My current job involves a lot of old (and new) visual basic 6 and there are parts of our software which don't work once you remove the magic line:

On Error Resume Next

<comment><USER12> I cracked open some code the other day to find it riddled with:

        on e goto end

</comment></comment></comment><comment><USER33> "In 1995 I quit my regular job as senior web engineer for Time-Warner and became a consultant developing interactive content for the World-Wide Web, which was still a pretty new thing at the time."

I am confused the person stated that they were a senior web engineer but quit to work on a new thing the WWW. How can you be a senior web engineer for something brand new?

Just nitpicking...

<comment><USER34> I believe "interactive content" is the key difference. I.e. non-static pages served via CGI.

</comment></comment><comment><USER35> This gave me a good laugh, i didn't know what to expect. Just today i had to deal with something at a similar level.

</comment><comment><USER36> One of the best examples of consultant failure i've ever seen. Clearly an example for

\- not enough questions asked \- not listened to the customer

Do not ever start building something or proposing a solution if you don't understand the customers problem deeply enough.

<comment><USER37> i dont think the problem lies with the consultant tho - how could he have figured out the actual business problem, if no body bothered to tell him? He was hired to do a particular task, and that task was pre-determined by some "stakeholders" who dont actually know what they want.

</comment></comment><comment><USER38> I can highly recommend Flawless Consulting by Peter Block. He covers all these issues and many others. Self awareness is critical to success. If you are inexperienced you need to be able to recognize/acknowledge your inexperience. Then read everything available on the subject and interview every expert you can identify. Clint Eastwood said it best, "A man's got to know his limitations". [http://www.youtube.com/watch?v=_VrFV5r8cs0](http://www.youtube.com/watch?v=_VrFV5r8cs0)

</comment><comment><USER39> Fascinating! As somebody who is starting to do freelance work a story like this is not only an interesting read but provides insight on what to avoid and when to speak up as I start freelancing.

<comment><USER40> hmm yes... until your pipeline slows down.

<comment><USER39> In general or because of tips I would take from the article? I'm not that concerned about a slow pipeline because at this time, I'm only going to freelance on nights and weekends.

</comment></comment></comment><comment><USER41> The shittiest project that I worked is just finished where we are not allowed to write any test cases cause we don't have time. I just can't believe that I finished fairly big project without writing a single test case. I hate my company, my role and managers, sales people who negotiate tight deadlines. Over all don't work for any consulting companies out there. They care less of the code quality. They just want money and no ethics.

My next job will be a product based company.

</comment><comment><USER42> Consider the price you paid to learn a key life lesson which will pay for itself multiple times over. If you learn from the situation, you have not failed.

</comment><comment><USER43> This is why:

1\. You should spend more time designing (away from the computer) so that you find a _problem_ and then come up with a reasonable solution. Instead of putting together a list of features. (see Rich Hickey's talk "Hammock-driven development").

2\. Think of the sum you're going to charge for your consulting and then multiply it by 4 and charge that because you have to take risk and other factors into account.

</comment><comment><USER44> The shittiest project? Hmm...if he got paid, not sure I'd classify it as such. A waste of time because of business getting in the way of potential efficiency that they perceived they wanted? Yes.

Also, let's not forget that this was 1995 and most big businesses weren't really fully aware of the potential of the internet and the disruption on standard business models that was going to ensue...

</comment><comment><USER9> Sounds like poor contract negotiation more than anything. Fixed quotes are very tricky things to navigate. I simply don't go there. If the client insists then I try to negotiate a fixed budget, then when the budget us running dry they can extend the budget or reduce scope. If they don't agree to that I walk.

<comment><USER45> So you would take on a project if they kept paying you per hour, even if the end result was useless?

<comment><USER9> Well to answer that I would need some context. Like :

a) Do I need the cash and is the market quiet at the time? b) Are there some other opportunities that might result? c) Is the hourly rate way higher than I could get somewhere else? d) Is the tedium only short term? e) Am I gaining some significant skills / experience? f) Did I give my word to do the job?

If the answer to any of the above is yes, I may well accept the project or continue on with the project, otherwise I would move on.

I remember when I was working in London, I was on the same contract for 2 years. About 9 months out from the end they extended my contract and we were asked to build a prototype of a system that automated a lot of human elements of the original system we built. We built the prototype, and it was very good, but the funding was pulled and most people left the project. By that stage I was about 4 months from my visa running out, and there was no work to do. So I stayed on and did nothing but about 30 minutes of support work per day and the rest of the time worked on pet projects and amused myself. I felt a little bad about it, as I was earning $120/hr, but I may well have been screwed if I tried to find work with only a few months left on my visa.

</comment></comment></comment><comment><USER46> Most shitty software is not because of the engineers, but management. Not putting value on good coded and tests.

</comment><comment><USER47> Interesting read. However, I helped build a web based system for the management of a bowel cancer screening programme. Considering what would be sent back on the testkits and processed into the system... it's the shittiest project I've ever worked on, but not for the same reasons :P

</comment><comment><USER48> The reason the fee was there was to pay for the 0800 thing.

Some executive rightly saw that paying you to render that useless would free them of that service and the need for the fee (which i bet was not turning a profit)

But, since big companies run on cargo cult... that happened.

<comment><USER49> In pretty much any business, and extremely so in real estate, referral fees are many orders of magnitude larger than paying for a free phone line.

I'm not working in real estate, but I'd guess that each referral would earn them at least something like $100 or much more - so forcing the "customer" (not really their customer since they don't sell anything to them, but only to the realtors) to call is the correct business decision.

The only WTF question is why they initiated a project that they don't want to use.

</comment></comment><comment><USER50> If that's the shittiest project you ever worked on then you're a lucky guy. User's will use a software project for all sorts of political purposes that have nothing to do with you and it does nothing but f up the process.

</comment><comment><USER51> This is how life insurance companies operate on a daily basis. OP had a pretty shitty deal but he should count his lucky stars that he didn't have to interact with actuaries, who would have multiplied the same problems ten-fold.

</comment><comment><USER52> wow! I am jealous. If that is the shittiest project he ever worked on, he really has not too much to complain about.

Add to this that this was back in 1995. Companies had no clue what the internet was nor what they wanted to do with it, so this kind of clueless behaviour what the customer wanted was pretty much standard for most companies up to at least 1998 - 1999.

The guy has either been tremendously lucky, or he has not worked in too many different projects / companies for the last 18 years....

</comment><comment><USER53> This got infinitely more readable when I loaded it into Pocket and let Pocket do its formatting on it. Adjustable font size and a more reasonable line width...

</comment><comment><USER54> I could see why development service team always want to get more and more information about a project. Open it more, then you get better return. Fun reading.

</comment><comment><USER55> Someone once told me: The client know what he wants, but not what he needs. Success is discovering that before the project ends.

Great post!

</comment><comment><USER56> Great [http://thedailywtf.com/](http://thedailywtf.com/) material.

<comment><USER12> In that case... TRWTF is that he did not charge them an arm and a leg for all of those planning meetings. If you charge appropriately, only necessary changes get made, and only needed software gets built (most of the time, but you stay paid and happy either way).

</comment></comment><comment><USER57> Without a pollyfill to support older browsers this is merely a peak into the future.

</comment><comment><USER58> Ask them what they're praying for, not how to pronounce the Latin.

</comment><comment><USER59> The shittiest project I ever worked on was a php project that was converted from another language (I don't remember which one). This doesn't sound bad, except they used software to automatically convert it. The PHP code had no comments, minimal white space, and the variables were all hex. My job was to fix bugs.

I worked there for about a week before I quit in frustration.

<comment><USER60> How can someone suggest auto convert into another language like that?

In the long run it would be cheaper rebuilding the entire thing.

<comment><USER61> I've actually been involved in at least three projects to do precisely that. And mostly they worked fine.

In two of the three cases I was converting between "the same language" but different incompatible versions of it and the original code bases had strict style guides. At the end of it everything worked brilliantly, and the code was just as maintainable as it was before the conversion.

In the third case was an full lexer/parser built out to compile VBScript down to JavaScript. The resulting code was not readable or maintainable but it did run and that satisfied the needs of the project.

In my experience is that language conversion projects are gnarly, and depend heavily on style guides and accurate specifications for the languages to produce good output. But these are not doomed enterprises from the start and in the end it's the quality of your convertering code that determines the success of the project.</comment></comment></comment>


Lone packet cripples telco networks  - <AUTHOR> http://www.scmagazine.com.au/News/318935,lone-packet-cripples-telco-networks.aspx

<comment><USER2> _"... We accessed [an operator's] systems through their x25 network which they never knew was running because the network vendor never disclosed it -- it was just underlying technology ..."_

Old school. X.25 allowed Julian Assange to attack NASA with the WANK worm via X.25

 _"... Tencati was sure he could show the WANK worm attack on NASA originated in France. But he also knew he had to document everything, to have exact answers to every question and counter-argument put forward by the French secret service agents at the FBI meeting. When he developed a timeline of attacks, he found that the GEMPAK machine showed X.25 network connection, via another system, from a French computer around the same time as the WANK worm attack. ..."_ ~ [http://suelette.home.xs4all.nl/underground/justin/chapter_2....](http://suelette.home.xs4all.nl/underground/justin/chapter_2.html)

<comment><USER3> I think I down-voted you by accident. I meant to upvote! Clumsy mouse movements. Great link.

<comment><USER2> _"... I think I down-voted you by accident. I meant to upvote! ..."_

don't worry about the karma. The book is good & I was reading it just before this film was shown locally: _'Underground: The Julian Assange Story'_ ~ <http://www.imdb.com/title/tt2357453/> set in Melbourne late 80's.

<comment><USER3> Yeah I'm in Australia too :). Melbourne. I saw "Underground" on TV and became bored very easily. I read two paragraphs of the text version that you linked and I was hooked! Makes me wish I was 20 years younger. I suppose we have our own movements now, but the physical computer bazaar's and the culture sound awesome.

</comment></comment></comment></comment><comment><USER4> I'll start by saying that I approve of security testing networks and the telco industry could do with more of it. I agree that security can be lax sometimes.

Sure, Telco SS7 networks and the equipment within them are just like any other in that there can be bugs that cause it to go down.

However, there are much higher barriers for entry to get an SS7 network link (c.f. a connection to the internet) and you're not going to keep it for very long if all you're doing is sending out SS7 messages crashing HLRs left, right and center.

I'm assuming that the packet he's talking about is a fuzzing attack and only affects a particular vendor's HLR and may have even been fixed by now. So if everyone in the world used the same vendor, all used the same software version and you had unfettered access to all of them, then yes, you could crash all of the HLRs in the world.

And really?... "World's HLR". Well I'm glad someone is nice enough to host a HLR for the world. And apparently crashing the "World's HLR" will stop one country's communication. Oh noes! Which one is it?! I hope it's not mine! And I'd be interested to see how crashing a HLR stops my landline and my internet connection from functioning.

<comment><USER5> The question I had is whether the femtocell claim is true - those are much easier to get access to. I'd like to believe that they're correspondingly more locked down but there is rather a long track record of telcos botching basic security design.

<comment><USER6> The presentation linked at the bottom , [http://conference.hitb.org/hitbsecconf2012kul/materials/D1T1...](http://conference.hitb.org/hitbsecconf2012kul/materials/D1T1%20-%20Philippe%20Langlois%20and%20Emmanuel%20Gadaix%20-%206000%20Ways%20and%20More.pdf) contains hints of numerous holes they've found in various networks, to among other things get access to an SS7 network.

</comment></comment></comment><comment><USER7> This does not surprise me at all - the telecom network is unbelievably fragile.

<comment><USER8> Not in the public's eyes...

And operators will do everything to keep it that way. Including covering up major compromise.

</comment></comment><comment><USER9> Has it been taken down or is it because I am on a Swedish IP? "403 - Forbidden: Access is denied. You do not have permission to view this directory or page using the credentials that you supplied."

<comment><USER10> It works here in the USA.

</comment></comment><comment><USER11> +++ATH

</comment><comment><USER12> Jesus christ I can't wait til there is a Y16 telco network</comment>


Advanced Javascript and Web Debugging Techniques - <AUTHOR> http://techblog.badoo.com/blog/2013/11/18/5-advanced-javascript-and-web-debugging-techniques-you-should-know-about/

<comment><USER2> One small tip I'd like to add:

Writing code in _Conditional Breakpoints_ \- So lets say you want to modify the value of _PRICE_ , but only if _ASIN == 'XYZ'_, then you can write:

        if(ASIN === 'XYZ') { PRICE = 20 }

as the condition for your breakpoint and instead of breaking at that point, the value of price will be changed only for that ASIN. Helped me a lot during involved debugging sessions.

<comment><USER3> This is a great idea !

</comment></comment><comment><USER4> The thing I really miss when debugging js (compared to other debuggers) is the ability to skip files when stepping. Seeing the innards of jquery/backbone/underscore is usually no use to me, I only want to look at our site's code.

I know I can get that effect by liberally sprinkling my code with 'debugger;', and could even automate that, but still...

<comment><USER5> Both Firefox and Chrome allow you to "blackbox" js files of your choice.

[https://developer.mozilla.org/en- US/docs/Tools/Debugger#Blac...](https://developer.mozilla.org/en- US/docs/Tools/Debugger#Black_box_a_source)

[http://www.divshot.com/blog/tips-and-tricks/ignoring- library...](http://www.divshot.com/blog/tips-and-tricks/ignoring-library-code- while-debugging-in-chrome/)

<comment><USER6> That's awesome, thanks.

By any chance, do you also know of a way to exclude jQuery event wrappers from inspection in the "events" part ? Like in this screenshot : [http://imgur.com/UaHTrth](http://imgur.com/UaHTrth)

This feature is pretty useless due to the fact that libraries wrap event callbacks.

<comment><USER7> That's something we're working on for Chrome. We'll have something soon.

<comment><USER6> Very nice, thanks for that.

</comment></comment></comment></comment></comment><comment><USER8> I should add that console.log has its pitfalls - in particular, it will log objects by reference, so if you are doing some manipulation later in a block, the value that may be displayed in the Chrome inspector may reflect a value that was manipulated later on in a block of code.

<comment><USER2> This is not the case anymore. They fixed this issue sometime back.

<comment><USER8> I've seen this exhibited as lately as Chrome 30.

</comment></comment></comment><comment><USER9> When needing a quick console to mobile I have previously used jsconsole[1] with great success. Weinre can be a bit overkill to set up just for logging some simple statements.

[1] [http://jsconsole.com/remote-debugging.html](http://jsconsole.com/remote- debugging.html)

</comment><comment><USER10> Oh man, weinre is one project that needs love now Adobe has their grubby hands on it.

It's really handy for mobile debugging.

</comment><comment><USER11> Regarding weinre: Is that any better than attaching desktop Safari to an ios simulator (not sure if it works for a physical device) or desktop Chrome dev tools to a real android device via adb?

In any case, note that that's also a lovely option.

<comment><USER12> I use it to debug android stock browser without ADB, or USB for that matter. I have a bookmarklet set up so I don't have to add the script to the page. The safari debugger is far superior for mobile safari on iOS, though. Primarily because js debugging in weinre is almost nonexistent in comparison.

</comment></comment><comment><USER13> I wouldn't call "debugger" advanced, but it is certainly useful.

Didn't know about the DOM breakpoint, though.

<comment><USER14> Funny, I'm the opposite. I've found DOM breakpoints useful for a while, but I've never heard of `debugger` until now. It seems obvious I guess.

</comment></comment><comment><USER15> This is very interesting and helpful. Thanks for posting.

</comment><comment><USER16> the remote debugging is already implemented in both Chrome and Firefox. Opera too as far as I know but it's not as simple as the others.

<comment><USER9> As far as I know, they all rely on you using their browser on mobile as well?

We faced a problem a few weeks ago, where Chrome for mobile worked fine, but the built in browser on Android phones pre 4.4 had some issues with our web app. Then we needed something else than Chrome to do the remote debugging.</comment></comment>


CNN investigation: 103 Uber drivers accused of sexual assault or abuse - <AUTHOR> http://money.cnn.com/2018/04/30/technology/uber-driver-sexual-assault/index.html <comment><USER2> Someone filed a complaint with the taxi company about me once... The safety manager read it to me: 'passenger states driver was hitting on her daughter'.

... I asked for the location of the pickup, and remembered her. The complaining passenger was distressed when I arrived at the address. Her 'friend' had thrown all her stuff out of the car (before I arrived on scene). The passenger's daughter's birthday cupcakes were 'ruined'. We first went to get the daughter a short distance away.

Mom wanted daughter to get in the cab. Daughter protested that it was her birthday, that she was having a good time and wanted to stay.

Eventually mom won the argument. Daughter got in the front passenger seat, as if to say "fine I'll come but I'm not sitting back there with _you._ "

I chatted with the daughter to hopefully take her mind off her mom ruining her birthday celebration. At the end of the ride I was going to ask something, then reconsidered as that would be crossing the line into 'creepy taxi driver' territory.

After hearing my version of the story, the safety manager told how the person who took the complaint had commented that if I was actually a problem, 'mom' would probably have called sooner than 3 days after the ride.

The company safety manager had stories of his own about how his efforts to be helpful were misinterpreted...

He also told of another driver who had some unaccompanied pre-teen girls. They wouldn't stop playing with the power windows, so he disabled their button, which greatly irritated the girls. When they got home, they told their mother that their driver had touched them. Mom called the police, who investigated... the taxi company consulted the cab's GPS logs, which were suspicious on account of the driver stopping his meter some time post-trip in the car wash... The driver was sweating bullets for a few weeks. The girls eventually confessed they'd made up their story...

There are certainly women who have problems with their drivers, but slander is a problem for the drivers too.

</comment><comment><USER3> A key fact left out of the reporting is how many Uber drivers does Uber employ in the USA ... ?

So it's 103 drivers out of what? 100,000 driver employees? Is this above or below the nation average. And what incompetencies if any is Uber responsible for.

<comment><USER4> Business insider says 327k drivers were active in the month of Sept 2015

[http://www.businessinsider.com/uber-doubles-its-drivers- in-2...](http://www.businessinsider.com/uber-doubles-its-drivers- in-2015-2015-10)

and WSJ says there were at least 160k by Jan 2015.

[https://www.wsj.com/articles/uber-touts-its-employment- oppor...](https://www.wsj.com/articles/uber-touts-its-employment- opportunities-1422229862) [http://www.businessofapps.com/data/uber- statistics/](http://www.businessofapps.com/data/uber-statistics/)

Not much hard US-specific data after that, but lots of people speculate it's around 1M drivers now.

[https://therideshareguy.com/how-many-uber-drivers-are- there/](https://therideshareguy.com/how-many-uber-drivers-are-there/)

In any case, these 103 sexual assault cases were over 4 years, or about 26 cases per year. Uber was giving 1.67M rides per day in March 2016.

[http://www.businessinsider.com/uber-says-its-profitable- in-t...](http://www.businessinsider.com/uber-says-its-profitable-in-the- us-2016-4)

That works out to 608M per year. By now, it's probably doing at least a couple of billion per year, but even if we use the 2016 numbers that's one case of assault every 23M rides. The average ride is about 6 miles and the fatality rate from driving is 1.25 deaths per 100 million vehicle miles, so that means one traffic fatality every 13M miles.

So a passenger is at least twice as likely -- and probably more like 10 times as likely -- to be killed in an accident than to be sexually assaulted by the driver.

<comment><USER5> This kind of agenda reporting is what gives mainstream news its fake-news reputation. A editor would make sure that the journalist put this into context (some simple math as the poster above has shown) and also have dug up some comparable statistics on taxis. It could be that taxis are 3x as dangerous for women and now the writer has put even more women in danger by steering them away from Uber toward taxis.

<comment><USER4> Yes, although I would want an editor who saw this article to simply throw it out. The journalist who wrote it is so obviously slanted, and has made such little effort to give the reader the relevant facts, that there's no hope of obtaining something balanced from them.</comment></comment></comment></comment>


Tor: The Second-Generation Onion Router (2004) - <AUTHOR> https://svn.torproject.org/svn/projects/design-paper/tor-design.html <comment><USER2> There is also I2P which is just like Tor but unlike it is designed to withstand the traffic from bittorrent clients (useful for people living in dorms on in America) and can also tunnel UDP (unlike Tor which can only tunnel TCP).

That being said, I really like the new onion-v3 protocol that Tor added as it moves from the outdated 1024-bit rsa + sha1 addresses with 1024-bit DH and AES-128 to the state-of-the-art ed25519 for addresses and handshake as well as chacha20-poly1305 for encryption.

<comment><USER3> I think it's an important distinction that one has identified developers, and one has anonymous developers.

It doesn't seem clear to me that one is generally better than another, I think they complement each other.

</comment></comment><comment><USER4> It mentions mixmaster and mixminion, but those projects seem to have died. I feel like they are needed more than ever.

<comment><USER5> Indeed. I've often thought that such high-latency mix-nets (with their potentially superior resistance to traffic analysis) would be a nice complement to low-latency networks like Tor.

<comment><USER6> The downside is that browsing the web on a service like that sucks ass. Tor trades off some security for a basic level of user experience.

Sadly, modern web design makes stuff like WWWoffle less useful than it used to be. Plus it's difficult to set up fully anonymous services on the far side of the link, I mean you're using Tor for a reason, and leaving breadcrumbs on the far side of the network is risky.

<comment><USER7> Using TBB has gotten much better over the past few years, often you can stream YouTube without much issue.

</comment></comment></comment></comment><comment><USER8> Tor is great, but it's always been a bit slow. Now that cryptocurrency is a thing, I often wonder if that problem could be solved by incentivizing the running of relays and exit nodes through microtransactions without compromising privacy. Would be great if we could make Tor fast enough that it could actually be used as a substitute for commercial VPNs.

<comment><USER9> That reminds me of this little onion routering thingy i made that spiraled out of control into a semi functioning project that I got hired to work on full time

([https://github.com/loki-project/loki-network](https://github.com/loki- project/loki-network))

<comment><USER10> Also a dev on loki-network, we have $4.1+ million USD so far invested in relays (and potentially exits). It's layer 3 (so think more like i2p) but newer crypto and much better latency.

A good overview of the project is here: [https://github.com/loki-project/loki- network/blob/master/doc...](https://github.com/loki-project/loki- network/blob/master/docs/high-level.txt)

other docs here: [https://github.com/loki-project/loki- network/blob/master/doc...](https://github.com/loki-project/loki- network/blob/master/docs/)

Join our test-net now: [https://discord.gg/eB8k6xQ](https://discord.gg/eB8k6xQ) or #llarp on freenode

</comment></comment></comment><comment><USER11> Tor is great! Sadly HN shadow bans all accounts created with it. Lots of other services also won't let you sign up or require a phone verification if you use it.

</comment><comment><USER12> Apparently not safe for work

<comment><USER13> A company could have a lot of problems if one of their employees decided to host a node in their network, so quite literally yeah

<comment><USER14> What kind of problems company could have?

<comment><USER15> I ran an exit node at home for a couple months. Within minutes of my dynamic IP being updated from my ISP, cloudflare could figure out that I was an exit node, and then would fail to differentiate my own, non tor traffic, with that of the traffic exiting my node. The result being every single cloudflare backed website will hit you with a captcha on every page you view.

My ISP would also randomly shut off my connection with some vague email about having compromised computer on my network i needed to fix. I'd have to call and make up some story to get them to turn my internet back on.

Essentially all kinds of people associate TOR with unsavory activity and as such put hoops to jump through when accessing stuff through tor. When you host an exit node your non tor traffic is considered to be outbound TOR traffic based on the IP the traffic originates from.

I cant imagine what would happen if I ran a node on the same network as our email server. I have to assume that we'd get blacklisted for spam quick if our mx resolved to a tor exit node IP.

Then there's the whole issue of more or less being guaranteed to be complicit in the distribution of CP. With really only safe harbor laws protecting you.

<comment><USER6> People associate TOR with unsavory activity because TOR is used for unsavory activity. Running an exit node on a link you care about is insanity.

The main reason I have never run an exit node is fear that some overzealous LEO trying to make a name for himself is going to trace an IP off of a kiddie porn or drug market to my house and send in SWAT to break all of my windows and tie me up in court for months before deciding that charging me as an accomplice probably won't work this time because I didn't opt for the public defender.

<comment><USER16> Exit nodes only handle traffic leaving the Tor network to clearnet sites. Nobody is going to run a child porn site or drug market on the clearnet.

<comment><USER6> No, but they'll access clearnet child porn/drug sites through your exit node. Not every criminal uses Tor.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> News?

</comment><comment><USER18> I keep copies of these papers in a safe in case I never need to re-develop the Internet from scratch. No seriously, the Tor papers are amazing and even hint at the means by which Tor might be manipulated to, say, track down someone like Ross Ulbricht, founder of the Silk Road, who is currently serving a double life sentence, plus forty years, without the possibility of parole.

<comment><USER19> >Ross Ulbricht, founder of the Silk Road, who is currently serving

For running a free market. It's fucked up.

<comment><USER20> Stop trying to rewrite history. He was convicted of running the market, but the reason the judge threw the book at him is because he tried to have five people killed.

>Because it is contested, the Court must make appropriate factual findings if it is to include it. The standard by which I do that is by a preponderance of the evidence. Ulbricht's directed violence here is and relates to the murders for hire which he is alleged to have commissioned and paid for. The Court must determine whether these allegations have been demonstrated by a preponderance of the evidence and I find that there is ample and unambiguous evidence that Ulbricht commissioned five murders as part of his efforts to protect his criminal enterprise and that he paid for these murders. There is no evidence that he was role-playing.

[https://freeross.org/wp- content/uploads/2015/05/Sentencing_2...](https://freeross.org/wp- content/uploads/2015/05/Sentencing_2015-May-29.pdf)

Maybe you think he didn't try to commission murders. Maybe you think judges shouldn't have so much latitude in deciding sentences. But the simple fact remains: Ulbricht is serving two life sentences mostly _because the judge found that he tried to kill five people._

<comment><USER21> > Maybe you think judges shouldn't have so much latitude in deciding > sentences.

Sure scares me. Why wasn't he tried for the other crimes if his punishment is going to be based on them? This isn't a little difference to take into account when sentencing, these are important crimes on their own deserving a right to trial.

<comment><USER22> Because you take them down how you can; in a similar light how Capone was taken down on taxes and not murder, corruption, smuggling, or conspiracy.

Or are all purveyors of the 'free market' automatically heroes in your eyes?

<comment><USER21> > Or are all purveyors of the 'free market' automatically heroes in your eyes?

No, I don't even like the guy. Why must I consider someone a hero to feel they deserve a trial for their punished actions?

<comment><USER22> A trial did occur for Ross Ulbricht; I don't understand your point.

<comment><USER23> If someone is _accused_ of X, but you "get them" for Y, and the sentencing is based on the fact that they "did" X... you never had a trial that proved that they did X, so anything you _think_ you know about their guilt of X shouldn't be relevant to their sentence for Y. Because you don't _really_ know.

And, even if you know mathematically without a doubt that "they did it" in point-of-fact, and you have all the evidence to back you up such that you're really sure that if you _did_ have a trial, it'd be an open-and-shut case... you still can't assume. Because it's not about whether _you_ see guilt or innocence when _you_ look at the evidence; it's about whether _the jury_ sees guilt or innocence when _they_ look at the evidence.

Jury nullification means a jury can just _decide_ , arbitrarily, that somebody's not guilty of something. And then double-jeopardy means that you can't ask that question again. It's been resolved, permanently: the accused has been declared innocent, in the eyes of the law—however strong your proof was! And any _further_ judgements by the courts have to take, as input, that innocent verdict that came out of the trial; not the proof-of-guilt that went _in_ but didn't survive.

What that implies, to me, is that in the Al Capone example, he should never have been treated as anything other than a regular tax evader, and should only have received a regular tax-evader's sentence.

I'm reminded heavily of the recent p-hacking controversy in science. Imagine a world where we "pre-register" a trial when an investigation is begun, and are then forced to go through with it (and pretend the government has the infinite money required to enable this.) In this world, that trial would likely declare the suspect innocent a lot of the time... and all the evidence gathered to do so would be "used up" by that trial. You couldn't turn around and use the same evidence to prove that "because he's guilty of X, it's more likely that..." anything else. Because, in the eyes of the law, he _isn 't_ guilty of X, and anything that proves that, doesn't. The evidence itself was nullified when the verdict was.

In the real world, just to save time and money, we don't bother to prosecute trials we know we'll lose. But shouldn't the _effects_ still be the same as if we did? An optimization shouldn't change the semantics of the system.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> I love Tor and use it often (also collaborated with code and nodes). But the problem lately is that all sites are banning it. Even HN, gives you trouble when connecting through Tor.

<comment><USER25> Tor is often a vector for abuse, so tor node IPs get banned. I'd like to see a way to have nodes block certain origins without being able to identify them.</comment></comment>


Terry Moore: How to tie your shoes (3min video) - <AUTHOR> http://www.ted.com/talks/terry_moore_how_to_tie_your_shoes.html

<comment><USER2> He's just talking about the double slip granny knot versus the double slip reef (square) knot.

Much more interesting is "Ian's Knot"

<http://www.youtube.com/watch?v=1uONg5voLxo>

Explained more here:

<http://www.fieggen.com/shoelace/ianknot.htm></comment>


How I Decide Who Gets Banned on OkCupid - <AUTHOR> http://nymag.com/thecut/2017/02/banned-from-okcupid-sexting-moderation.html <comment><USER2> I would hate to have to deal with such things in my job as an engineer. And I'm not talking about C++. (Well, ok, maybe I am just a little bit.)

</comment><comment><USER3> A bit off topic but why does OkCupid use C++? Seems like a odd choice for a website and two mobile apps.</comment>


Show HN: Flume – A beautiful Instagram experience for your Mac and browser - <AUTHOR> https://flumeapp.com

<comment><AUTHOR> Hey all, I've been working in my evenings on a Mac app for Instagram with @mirgehtsganzgut that goes away with the social-side and distractions that Instagram throws at you and releases you from the pretty basic web-version that Instagram offers. Edge-to-edge beautiful photos sliding by your screen throughout the day was one of the key ideas of making Flume - it wasn't important to me who posted a photo or how many likes and comments it had - <USER2> me it was about the photo. That's what inspired the feed view. Of course, Instagram is a social network, so those details are still available for you there if you want them, but the idea was to highlight photography, not followers.

While working on Flume for Mac, I discovered an opportunity to give a smaller but still beautiful Instagram experience to people who don't have a Mac and for those that didn't want to browse via an app. I open hundreds of tabs a day and I don't want to go to my phone to check my Instagram feed, and that's where Flume New Tab was born. Available now for Safari and Chrome, you can bring some beauty to your blank tabs!

Flume for Mac is currently in beta and I'm taking some limited testers on board - Instagrammers are obviously preferred. Get in touch on the website to let me know.

If you're curious about the name - since it's shared with a famous musician - flume is an old English word that means a river or stream. When new items photo pop into the Mac app, it feels like a drop of water in a stream.

Thanks and happy browsing!</comment>